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Symmetric extendibility of quantum states has recently drawn attention in the context of quantum 
cryptography to judge whether quantum states shared between two distant parties can be purified by 
means of one-way error correction protocols. In this letter we study the symmetric extendibility in a 
specific class of two-qudit states, i. e. states composed of two d-level systems, in order to find upper 
bounds on tolerable error rates for a wide class of qudit-based quantum cryptographic protocols 
using two-way error correction. In important cases these bounds coincide with previously known 
lower bounds, thereby proving sharpness of these bounds in arbitrary finite-dimensional systems. 
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Quantum cryptography or quantum key distribution 
was introduced^by the seminal work of Bennett and Bras- 
sard in 1984 [l|. It was widely conjectured to provide 
means for unconditionally secure communication of two 
distant parties, Alice and Bob, even in the presence of 
an adversary, Eve, who can be detected by the quantum- 
mechanically-induced noise every attack produces. How- 
ever, security proofs still left loopholes, until Mayers [2] 
came up with a proof which provided unconditional secu- 
rity even for some finite amount of noise. Since every real 
physical channel inevitably produces noise, however low 
it may be, this proof amounts to the advent of practically 
useful quantum cryptography. Starting from this work, 
the security of quantum cryptography has been investi- 
gated in various scenarios and its security was proved 
therein. Whereas most of the efforts have been per- 
formed with respect to two-dimensional systems {qubits 
with Hilbert space Ti. — C'^) as basic quantum systems, a 
large number of concepts and methods carry through for 
arbitrary finite-dimensional systems (qudits with Hilbert 
space H = C^). Such general finite-dimensional sys- 
tems will be the main focus of this letter. However, we 
do not consider infinite-dimensional systems (continuous- 
variable quantum key distribution), since the protocols 
and scenarios employed there differ considerably from the 
finite-dimensional case. 

A particularly important task in quantum- 
cryptography-related research is to identify maximally 
tolerable error rates, i. e. the error rates measurable 
by Alice and Bob, up to which a physical channel 
may be used for quantum key distribution without 
compromising the unconditional security. For the BB84 
protocol, this question can be answered by considering 
an entanglement-based version [3] of that protocol with 
an appropriate choice of entanglement purification. 
Under particular circumstances, this protocol can be 
reduced to yield security of the original BB84 protocol 
itself by transforming the entanglement purification 
to some post-processing, namely error correction and 
privacy amplification. One generically distiguishes 
two types of post-processing. The first kind only uses 



one-way classical communication, i. e. in the course of 
post-processing Alice may send classical information 
to Bob, but not vice versa; Shor and Preskill used 
such protocols to show security of the BB84 protocol 
up to an error rate of 11.0% [J|. The second kind of 
post-processing uses both one- and two-way classical 
communication Q, and this can be used to derive 
tolerable error rates of 20 % for the BB84 protocol 
E 0, H- (One should note, that by one-way protocols 
only, it is impossible to exceed a rate of about 15%, 
since an arbitrary qubit state can be duplicated, if this 
rate of error is allowed.) By now no protocol is known 
which works above 20 % error rate, although it has been 
shown 9] that effective entanglement, which is necessary 
for key generation, exists up to an error rate of 25%. 
At present, there exists no purification protocol which 
works between these two bounds, and it is unknown 
whether this gap can be closed at all. 

A different approach to investigate t his p roblem was 
recently undertaken by Myhr et al. l^, Hi, who posed 
the question, which condition a quantum state has to 
fulfil in order to be correctable, using one-way classical 
communication only. They found that the concept of 
symmetric extendibility served their purpose, i. e. that a 
state which possesses a symmetric extension cannot be 
purified by any possible protocol with one-way commu- 
nication only. By working out a criterion for symmetric 
extendibility for two-qubit states they achieved to show 
that the abovementioned bound of 20 % cannot be sur- 
passed by standard means of two-way entanglement pu- 
rification @, 0, @|) which indicates the need of new 
two-way protocols. Finally, we should note that all re- 
sults we mentioned for the BB84 protocol carry over for 
the six-state protocol 12^, ff the rates of 20 % and 25 % 
are replaced by 27.6%' and 33.3% @, 0, i, i, E 111 | ■ 

The aforementioned results show that the tolerable er- 
ror rates of the most important qubit-based protocols are 
known, at least in a reasonable scenario using the error 
correction and privacy amplification available at present. 
One may ask whether similar results hold true for gen- 
eral finite-dimensional systems, in case we use generalised 
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BB84 and six-state schemes. While lower bounds for 
such cases are known 13, 14, [isl [Til , with the excep- 
tion of disentanglement bounds [17[ we are not aware of 
a systematic study of upper bounds, which is the main 
purpose of this letter. By performing an analysis similar 
to that of Myhr et al., we will derive upper bounds on 
the tolerable error rates with two-way communication. 
As Myhr et al. did for qubit-based protocols, we show 
that these upper bounds coincide with the lower bounds 
already known 13, 14, 15, T^, thus proving sharpness of 
these bounds. In the following we will state the details 
of the model and our proof. 

Let us start by introducing the concept of symmetric 
extendibility and its relevance in quantum cryptography 

Definition (Symmetric extendibility) 

A state pab on the tensor product'HA®'HB of two Hilbert 
spaces is said to be symmetrically extendible, if there 
exists a tripartite state pabe on Ha ® Ti-B (i> Ti-E with 
He = Hb, such that Tce Pabe = Pab (extendibility) 
and PABE — PAEB (symmetry) hold. 
Obviously all separable states possess symmetric exten- 
sions, whilst no pure entangled state can be extended. 
The general solution to the problem, whether a state is 
symmetrically extendible or not is unsolved, however, a 
criterion for Bell-diagonal two-qubit states is known [lO| 
and, more generally, criteria for general two-qubit states 
have been investigated [lll |. The relevance of symmetric 
extendibility in quantum cryptography arises from the 
following observation [l3| : If Alice and Bob share a sym- 
metrically extendible state, we cannot exclude the pos- 
sibility that Eve holds the extension. If Alice then tries 
to use one-way communication to establish a secret key 
with Bob, she will fail, since Eve could do precisely the 
same as Bob, and Bob and Eve are indistinguishable to 
Alice. 

We shall now introduce a class of two-qudit states, 
which was shown to be relevant in quantum cryptog- 
raphy. For states within this class we have derived a 
criterion for symmetric extendibility (Theorem [1]), which 
enables us to obtain a simple sufficient condition for this 
property. Based upon this condition, we will derive upper 
bounds for qudit-based quantum cryptographic protocols 
and compare them with the previously known results. To 
this end, we will in the course of this letter focus on a 
particular two-way error correction step, the B^rf ^ step 
(see below) , which is essentially the only genuine two-way 
post-processing method used in quantum cryptography. 
Applying this step to a chosen initial state, we will check 
whether we can reach a state which does not possess a 
symmetric extension. If this is not the case, we conclude 
that no protocol in the class considered can produce a 
secret key for a particular given error rate. The bounds 
which we derive lie below the disentanglement threshold 
17|. Thus, in order to achieve this threshold — if it is pos- 
sible at all — new two-way methods have to be invented. 



To determine whether a general state is symmet- 
rically extendible or not is a complicated task, even 
for two-qubit states 11|. However, in the context of 



entanglement-based quantum cryptography by using ar- 
guments of the Gottesman-Lo type [5| we may concen- 
trate on a subclass of all states, namely the (generalised) 
Bell-diagonal states 0, 0, 0, B [ll Q 111 on H = C'^C'^ 
where d is the dimension of a single quantum system, 
shared by Alice and Bob. This is achieved by a fictive- 
measurement argument Q : One can perform a measure- 
ment in the so-called Bell basis before starting the ac- 
tual protocol, and such measurement does not have any 
measurable effect on the key. The Bell basis consists of 
vectors (we denote z := exp[27ri/c?], and is to be taken 
modulo d) 



(1) 



for I, m e {0, . . . , d — 1}, and the Bell-diagonal states 
can be written in the form 



^ — ^/,m— 



(2) 



These states are completely determined by their coeffi- 
cient matrix (^;m)fmLo- Choosing the perfect state to 
be |^'oo)(^oo| — Alice and Bob can locally measure in the 
standard basis and get one perfectly correlated key dit — 
we can interpret nonzero I and m to be phase and dit 
errors, respectively. 

In quantum cryptography we may assume that Alice 
and Bob share a large number of identical Bell-diagonal 
states, i.e. p®^ for Bell-diagonal p and iV 3> 1, which 
have to be processed by using one-way and two-way com- 
munication to yield the state |^'oo)(^oo| [5]. Assuming 
that the state does not possess a symmetric extension, we 
have to use two-way entanglement purification in order 
to break the symmetric extension [lol . |Tl| . Apart from 
minor modifications, all known genuine two-way proto- 
cols are variations of the Bif"^ step, so we may focus on 
that particular step [l^: Alice and Bob choose n G N 
qudit pairs, all prepared in the state p with coefficients 
(^;m)fmLo- They then locally apply generahsed XOR 
operations \i)\j) \i)\i Q j) from the first to all other 
pairs and afterwards measure the dit values of all pairs 
except the first one. They compare the parities of all n— 1 
measurements by means of classical (two-way) communi- 
cation and keep the first pair, only if all parities coincide. 
If they keep the first pair, it will be described by coeffi- 
cients (^Jm)f~Lo' which are given by 15] 



A'. 



Im 



(3) 



where N := J2'L2o{J2f=o ^im)" ■ This state has in 
general less dit errors but more phase errors than the 
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original state by the properties of the generalised XOR. 
Since we can assume an error rate below 50% 17[, i.e. 
X; > 1/2, in the limit of large n G N, the output 

state of the B^f-' step lies in the neighbourhood of the 
separable state defined by Ai^ = d~^Smo- 

We can even further reduce the set of states which 
have to be taken into consideration by enforcing their 
invariance with respect to the Abelian unitary group 
1X2 '■— {U (g) U* \ [/diagonal in the standard basis}. This 
is due to the fact that the _Bi''''step eliminates all kinds 
of error affected by this symmetrisation, so that they do 
not enter in the one-way correction part Such 1X2- 

invariant Bell-diagonal states are characterised by the 
additional property that Aim — d~^A^m holds with 
A^m ■= J2i ^im for all m 7^ 0. 

One can now try to explicitly construct a symmetric 
extension of the given state as a d'^ x (P matrix. The il2- 
invariance implies that a symmetric extension, if it ex- 
ists at all, can be chosen to be invariant with respect to 
1X3 := {U ®U* ®U* \ [/diagonal in the standard basis}, 
and this leads to a block matrix structure of the ex- 
tension. By some further processing, one can work out 
a criterion for symmetric extendibility for il2-invariant 
Bell-diagonal states. Definin g A jr, := J^i ^ioz''^'^~^\ this 
criterion reads as follows p. 91]. 

Theorem 1 (Symmetric extendibility) 
A ii2-invariant Bell-diagonal state is symmetrically 
extendible, if and only if {d^^Aip)ip e £,d.^<i ^an he de- 
composed into the sum of d matrices Bq, Bi, . . . , B^^i, 
such that every matrix Bk = {o,[p^)ip is positive and 



< d ^A^jQk for all i, k ^ {0, . 
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Although this condition is in general difhcult to check, it 
turns out that it is sufhcient for calculating upper bounds 
on tolerable error rates in quantum cryptography. To this 
end, we have to find an explicit solution to Theorem [1] 
nearby the state with coefficients Aim ~ d^^Smo as men- 
tioned before. 

For such a state A*o ~ 1 and A^,m ~ for m 7^ 
hold. Comparing this with Theorem [1] we conclude that 
in every matrix Bk one of the diagonal elements can be 
large, while all others have to be small. Thus we are 
tempted to choose the matrix e. g. Bq to have the form 



/a vl ■■■ V*d-i\ 
771 (3, ... 



V2 (32 



Vld- 



'■■ 

Pd-iJ 



(4) 



where a 



JO) 



may be large and the (3i 



al°^ have to be 



small. For the other Bk we assume a similar structure, 
but a and the r]i lie on the (fc — l)-th row and column. 
Since the matrix has to be positive, and thus every 2x2 
principal minor must be non-negative, we may say that 



the elements set to zero have to be quadratically small 
1/2. 

in /3j , whilst the rji are only linearly small. 

The point of enforcing this matrix structure is that it is 
positive, if and only if (a) all diagonal elements are non- 
negative and (b) its determinant is non-negative. This 
follows by direct application of the well-known Hurwitz- 
Sylvester criterion for positive semidefiniteness, which 
states that a Hermitian matrix is positive semidefinite, 
if and only if all principal minors are non-negative; see 
e-g- p. 282]. If all f3k are strictly positive, we can 
write the determinant of the matrix in Q as 



d-l 



E 



(5) 



and we may focus on the right factor of that product. 

We now want to construct a matrix Bq of the form 
mentioned in eq. ([4]). The other matrices Bk shall have 
the same entries, but the row and column structure is per- 
muted according to the conditions of Theorem [TJ Note 
that the exceptional element a for these Bk wanders 
along the diagonal with increasing k = 0, 1, 1, 
but that does not alter positivity. It seems appropriate 
to set the small values f3m to their maximally possible 
value Pm ■= d~^Aifm according to Theorem [1] so nor- 
malisation enforces a :— (2yl*o — ^)/d. Since all diagonal 
elements are non-negative, we find 



E 



< 



2A,o - 1 1 - 2(1 - A,o) 



(6) 



to be necessary and sufficient for positivity. (Given the 
case that some A^m — 0, this is to be interpreted that 
the coefficient r^m must vanish.) For a state to be sym- 
metrically extendible, rjm + ^*dQm = rf~^AmO must hold 
in addition for all me {l,...,c?— 1}. Since in the in- 
equality ([6]), there appear only absolute values, we may 
set the phases of 77™ and rfj^Qm to be equal, for choos- 
ing small |77i| does not harm positivity. We thus remain 
with the condition |77„i| + IrydemI = c^^^l^mol- Setting 
l^ml =• Xm'^^"'^|Amo|i wc Can rewrite the inequality as 



E 



d-l 
m— 1 



A 



2A^ 



< 1, 



(7) 



which is to be fulfilled under the additional constraint 

Xm + XdQm = 1- 

Applying a B^^ step to the state, equation ^ implies 
Km = KJN^ and i;„o = KnJN with iV = E„ 
and the condition then reads 



E 



■m— 1 



1 



''N \ A 



An 

> *?Tj 

' N 



< 1. 



(8) 



We shall ignore the second term in the limit n —^ oo, since 
it converges to zero. For the first term we can use the 
inequality iV < A",,, which gets tight for n ^ oo. The 
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term in question then is |Amo|^/(^*o^*m); if it is less 
than 1, it will disappear for n c», otherwise we have to 
suppress it by setting Xm 0. This will not be possible, 
if both |i„oP/(^*o^*m) and |imol V(-4,o^*,dem) are 
greater than 1, which shows the following theorem. 
Theorem 2 (Non-correctability) 
After the application of a step for sufficiently large 
n to a H2-invariant Bell-diagonal state with A^q > 1/2, 
the output state is symmetrically extendible, if there hold 
the inequalities \Amo\'^ < A 

*o * max {vl^ii^T^ , A^^dQni} for 

all m € {1, . . . ,d— 1}. 

In the apparently-isotropic case, that is the case where 
we enforce = (1 — A^Q)/{d — 1) for all m 0, the 
condition reads 



maxlii|i™ol) <^*o 



1 - 



(9) 



If we replace "<" by ">", this is our sufficient condi- 



tion for correctability [15|, so that these two results are 
complementary (apart from the case of equality). 

A particularly simple and instructive case is the 
generalised-isotropic case IJ, |l5|. In the U2-invariant 
case, we have two non- negative real parameters a and /3 
which fulfil a + {d — l)/3 < 1, and the coefficients of the 
state are given by 



Aim — 



l-a-(d-l)f3 
d(d-l) 



if I = m = 0, 
else. 



(10) 



Denoting x := a + {d ~ l)/3, we thus compute 



A ■ — 



a — P, else 



if i — p, \ X, if m = 0, 

' ^ i l-x 



else; 



(11) 

inequality Q now reads {a — l3)'^{d — 1) < x ■ {1 — x) and 
can be rewritten as 



a 



{d-l)f3^ 



a+id-l)f3 



< 0. 



(12) 



This again is complementary to our result that a 
state can indeed be corrected, if the left-hand side is 
strictly positive, leaving apart the case where we have 
equality. 

To conclude this letter, we have used a criterion for the 
symmetric extendibility (Theorem [1]) within the class of 
il2-invariant two-qudit states in order to show that stan- 
dard two-way error-correction procedures {B^^^ steps) 
cannot be used to improve on the already known con- 
structive bounds stated e.g. in 13, 14, 1^ by any type 



of one-way communication. This was done by choosing 
a well-suited class of matrices for that problem, which 
enabled us to derive upper bounds; these bounds coin- 
cide with the previously known bounds, thereby showing 
their sharpness. In particular, our results coincide with 
those of Myhr et al. [10] in the case of qubits {d = 2). 
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